CVE-2026-73312

Analyzed Analyzed - Analysis Complete

Refresh Token Replay in XenForo

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: VulnCheck

Description

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-73312

Affected Vendors & Products

Vendor	Product	Version / Range
xenforo	xenforo	to 2.3.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

XenForo before 2.3.13 has a refresh token replay vulnerability. When an access token expires, the system fails to invalidate the associated refresh token. Attackers can reuse the same refresh token multiple times to generate new access and refresh token pairs, maintaining unauthorized access for the token's full lifetime.

Detection Guidance

To detect this vulnerability, check if your XenForo version is below 2.3.13. Use the command: grep -r 'XenForo' /path/to/install | grep 'version'. If the version is below 2.3.13, the system is vulnerable. Additionally, monitor OAuth2 refresh token usage logs for repeated submissions of the same refresh token generating new access tokens.

Impact Analysis

If an attacker obtains a valid refresh token and client secret, they can repeatedly generate new access tokens without detection. This allows persistent unauthorized access to user accounts, even after the original token expires, effectively extending the lifetime of compromised credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating confidentiality requirements in GDPR and HIPAA. It undermines access control mechanisms, potentially resulting in non-compliance with data protection regulations due to prolonged exposure of personal or health information.

Mitigation Strategies

Immediately upgrade XenForo to version 2.3.13 or later to patch the vulnerability. If upgrading is not possible, disable OAuth2 refresh token functionality or restrict access to the refresh token endpoint until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-73312. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70